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THE APPLICATION IDENTIFIED ABOVE HAS BEEN EXAMINED AND IS ALLOWED FOR ISSUANCE AS A PATENT. 
PROSECUTION ON THE MERITS IS CLOSED . THIS NOTICE OF ALLOWANCE IS NOT A GRANT OF PATENT RIGHTS. 
THIS APPLICATION IS SUBJECT TO WITHDRAWAL FROM ISSUE AT THE INITIATIVE OF THE OFFICE OR UPON 
PETITION BY THE APPLICANT. SEE 37 CFR 1.313 AND MPEP 1308. 

THE ISSUE FEE AND PUBLICATION FEE (IF REQUIRED) MUST BE PAID WITHIN THREE MONTHS FROM THE 
MAILING DATE OF THIS NOTICE OR THIS APPLICATION SHALL BE REGARDED AS ABANDONED. THIS 
STATUTORY PERIOD CANNOT BE EXTENDED . SEE 35 U.S.C. 151. THE ISSUE FEE DUE INDICATED ABOVE DOES 
NOT REFLECT A CREDIT FOR ANY PREVIOUSLY PAID ISSUE FEE IN THIS APPLICATION. IF AN ISSUE FEE HAS 
PREVIOUSLY BEEN PAID IN THIS APPLICATION (AS SHOWN ABOVE), THE RETURN OF PART B OF THIS FORM 
WILL BE CONSIDERED A REQUEST TO REAPPLY THE PREVIOUSLY PAID ISSUE FEE TOWARD THE ISSUE FEE NOW 
DUE. 



HOW TO REPLY TO THIS NOTICE: 

I. Review the SMALL ENTITY status shown above. 

If the SMALL ENTITY is shown as YES, verify your current 
SMALL ENTITY status: 

A. If the status is the same, pay the TOTAL FEE(S) DUE shown 
above. 

B. If the status above is to be removed, check box 5b on Part B - 
Fee(s) Transmittal and pay the PUBLICATION FEE (if required) 
and twice the amount of the ISSUE FEE shown above, or 



If the SMALL ENTITY is shown as NO: 



A. Pay TOTAL FEE(S) DUE shown above, or 



B. If applicant claimed SMALL ENTITY status before, or is now 
claiming SMALL ENTITY status, check box 5a on Part B - Fee(s) 
Transmittal and pay the PUBLICATION FEE (if required) and 1/2 
the ISSUE FEE shown above. 



II. PART B - FEE(S) TRANSMITTAL, or its equivalent, must be completed and returned to the United States Patent and Trademark Office 
(USPTO) with your ISSUE FEE and PUBLICATION FEE (if required). If you are charging the fee(s) to your deposit account, section "4b" 
of Part B - Fee(s) Transmittal should be completed and an extra copy of the form should be submitted. If an equivalent of Part B is filed, a 
request to reapply a previously paid issue fee must be clearly made, and delays in processing may occur due to the difficulty in recognizing 
the paper as an equivalent of Part B. 

III. All communications regarding this application must give the application number. Please direct all communications prior to issuance to 
Mail Stop ISSUE FEE unless advised to the contrary. 

IMPORTANT REMINDER: Utility patents issuing on applications filed on or after Dec. 12, 1980 may require payment of 
maintenance fees. It is patentee's responsibility to ensure timely payment of maintenance fees when due. 
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PART B - FEE(S) TRANSMITTAL 

Complete and send this form, together with applicable fee(s), to: Mail Mail Stop ISSUE FEE 

Commissioner for Patents 
P.O. Box 1450 

Alexandria, Virginia 22313-1450 
or Fax (571)-273-2885 

INSTRUCTIONS: This form should be used for transmitting the ISSUE FEE and PUBLICATION FEE (if required). Blocks 1 through 5 should be completed where 

appropriate. All further correspondence including the Patent, advance orders and notification of maintenance fees will be mailed ' '' ' ' ' ' — " 

indicated unless corrected below or directed otherwise in Block 1. by (a) specifying a new correspondence address; and/or (b) in 
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Fee(s) Transmittal. This certificate cannot be used for any other accompanying 
papers. Each additional paper, such as an assignment or formal drawing, must 
nave its own certificate of maiUng or transmission. 

Certificate of Mailing or Transmission 
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1. Change of correspondence address or indication of "Fee Address" (37 
CFR 1.363). 

Q Change of correspondence address (or Change of Correspondence 
Address form PTO/SB/122) attached. 

Q "Fee Address" indication (or "Fee Address" Indication form 
PTO/SB/47; Rev 03-02 or more recent) attached. Use of a Customer 
Number is required. 



CLASS-SUBCLASS 



713-200000 



2. For printing on the patent front page, Ust 

(1) the names of up to 3 registered patent attorneys 
or agents OR, alternatively, 

(2) the name of a single firm (having as a member a 
registered attorney or agent) and the names of up to 
2 registered patent attorneys or agents. If no name is 
Usted. no name will be printed. 



3. ASSIGNEE NAME AND RESIDENCE DATA TO BE PRINTED ON THE PATENT (print or type) 
PLEASE NOTE: Unless an assignee is identified below, no assignee data will appear on the paten 
recordation as set forth in 37 CFR 3.11. Completion of this form is NOT a substitute for fiUng an assi; 

(A) NAME OF ASSIGNEE (B) RESIDENCE: (CITY anc 



assignee is identified below, the document has been filed for 
STATE OR COUNTRY) 



Please check the appropriate as 



3t be printed on the patent) : Q Individual Q Corporation or other private group entity Q Goven 



Q PubUcation Fee (No small entity discount permitted) 
Q Advance Order - # of Copies 



4b. Payment of Fee(s): (Please first reapply any previously paid is 

Q A check is enclosed. 

□ Payment by credit card. Form PTO-2038 is attached. 

□ The Director is hereby ai 
overpayment, to Deposit . 



5. Change in Entity Status (from status indicated above) 

□ a. AppUcant claims SMALL ENTITY status. See 37 CFR 1.27. □ b. Applicant 




ng SMALL ENTITY status. See 37 CFR 1.27(g)(2). 
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interest as shown by the records of the United States Patent and Trademark Office. 
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er party in 
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benefit by the pubUc which is to file (and by the USPTO to process) 
^ ^ ^ to take 12 minutes to complete, including gathering, preparing, and 

submitting the completed appUcation form to the USPTO. Time will vary depending upon the individual case. Any comments on the amount of time you require to complete 
this form and/or suggestions for reducing this burden, should be sent to the Chief Information Officer, U.S. Patent and Trademark Office, U.S. Department of Commerce, P.O. 
Box 1450, Alexandria, Virginia 22313-1450. DO NOT SEND FEES OR COMPLETED FORMS TO THIS ADDRESS. SEND TO: Commissioner for Patents, P.O. Box 1450, 
Alexandria, Virginia 22313-1450. 

Under the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a vaUd OMB control number. 
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Determination of Patent Term Adjustment under 35 U.S.C. 154 (b) 

(application filed on or after May 29, 2000) 

The Patent Term Adjustment to date is 1231 day(s). If the issue fee is paid on the date that is three months after the 
mailing date of this notice and the patent issues on the Tuesday before the date that is 28 weeks (six and a half 
months) after the mailing date of this notice, the Patent Term Adjustment will be 1231 day(s). 

If a Continued Prosecution Application (CPA) was filed in the above-identified application, the filing date that 
determines Patent Term Adjustment is the filing date of the most recent CPA. 

Applicant will be able to obtain more detailed information by accessing the Patent Application Information Retrieval 
(PAIR) WEB site (http://pair.uspto.gov). 

Any questions regarding the Patent Term Extension or Adjustment determination should be directed to the Office of 
Patent Legal Administration at (571)-272-7702. Questions relating to issue and publication fee payments should be 
directed to the Customer Service Center of the Office of Patent Publication at l-(888)-786-0101 or 
(571)-272-4200. 
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Notice of Allowability 


Application No. 

09/905,343 


Applicant(s) 

CHANDNANI ETAL. 


Examiner 

MICHAEL PYZOCHA 


Art Unit 

2437 





~ The MAILING DATE of this communication appears on the cover sheet with the correspondence address- 

All claims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in this application. If not included 
herewith (or previously mailed), a Notice of Allowance (PTOL-85) or other appropriate communication will be mailed in due course. THIS 
NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative 
of the Office or upon petition by the applicant. See 37 CFR 1.313 and MPEP 1 308. 

1 . ^ This communication is responsive to corrected Appeal Brief filed 07/07/2009 . 

2. lEI The allowed claim(s) is/are 1-14.16-22 and 24 . 

3. □ Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 

a) Dan b)nSome* c) □ None of the: 

1. n Certified copies of the priority documents have been received. 

2. n Certified copies of the priority documents have been received in Application No. . 

3. O Copies of the certified copies of the priority documents have been received in this national stage application from the 

International Bureau (PCT Rule 17.2(a)). 
* Certified copies not received: . 

Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements 
noted below. Failure to timely comply will result in ABANDONMENT of this application. 
THIS THREE-MONTH PERIOD IS NOT EXTENDABLE. 

4. □ A SUBSTITUTE OATH OR DECLARATION must be submitted. Note the attached EXAMINER'S AMENDMENT or NOTICE OF 

INFORMAL PATENT APPLICATION (PTO-152) which gives reason(s) why the oath or declaration is deficient. 

5. □ CORRECTED DRAWINGS ( as "replacement sheets") must be submitted. 

(a) □ including changes required by the Notice of Draftsperson's Patent Drawing Review ( PTO-948) attached 

1) □ hereto or 2) □ to Paper No./Mail Date . 

(b) □ including changes required by the attached Examiner's Amendment / Comment or in the Office action of 

Paper No./Mail Date . 

Identifying indicia such as the application number (see 37 CFR 1.84(c)) should be written on the drawings in the front (not the back) of 
each sheet. Replacement sheet(s) should be labeled as such in the header according to 37 CFR 1.121(d). 

6. □ DEPOSIT OF and/or INFORMATION about the deposit of BIOLOGICAL MATERIAL must be submitted. Note the 

attached Examiner's comment regarding REQUIREMENT FOR THE DEPOSIT OF BIOLOGICAL MATERIAL. 



Attachment(s) 

1 . □ Notice of References Cited (PTO-892) 

2. □ Notice of Draftperson's Patent Drawing Review (PTO-948) 

3. □ Information Disclosure Statements (PTO/SB/08), 

Paper No./Mail Date 

4. □ Examiner's Comment Regarding Requirement for Deposit 

of Biological Material 



5. n Notice of Informal Patent Application 

6. □ Interview Summary (PTO-413), 

Paper No./Mail Date . 

7. ^ Examiner's Amendment/Comment 

8. ^ Examiner's Statement of Reasons for Allowance 

9. □ Other . 
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DETAILED ACTION 

1 . Claims 1-14, 16-22 and 24 are pending. 

2. Appeal Brief filed 01/21/2009 (with corrections filed 07/07/2009) has been 
received and considered. 



EXAMINER'S AMENDMENT 

3. An examiner's amendment to the record appears below. Should the changes 
and/or additions be unacceptable to applicant, an amendment may be filed as provided 
by 37 CFR 1 .312. To ensure consideration of such an amendment, it MUST be 
submitted no later than the payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview 
with Luke Pedersen (Reg. No. 45,003) on 09/16/2009. 

The application has been amended as follows: 
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Claim 1 (Currently Amended) A method of detecting script language viruses in 
data streams comprising: 

using a processor for: 

preparing language description data corresponding to at least one script 
language; preparing detection data for viral code corresponding to a script language 
virus; lexically analyzing a data stream to identify the at least one script language; 

lexically analyzing the data stream using the language description data to 
generate a stream of tokens; 

generating viral code detection data by analyzing a plurality of samples of 
polymorphic script language viral code; and 

lexically analyzing the stream of tokens using the detection data and the 
language description data to identify the script language virus. 

Claim 13 (Currently Amended) A program storage device readable by a machine, 
tangibly embodying a program of instructions executable by the machine to perform 
method steps for detecting script language viruses, the method steps comprising: 

preparing language description data corresponding to at least one script 
language; preparing detection data for viral code corresponding to a script language 
virus; lexically analyzing a data stream to identify the at least one script language; 

lexically analyzing the data stream using the language description data to 
generate a stream of tokens; 
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generating viral code detection data by analyzing a plurality of samples of 
polymorphic script language viral code: and 

lexically analyzing the stream of tokens using the detection data and the 
language description data to identify the script language virus. 

Claim 14 (Currently Amended) A computer system, comprising: a processor; and 
a program storage device readable by the computer system, tangibly embodying a 
program of instructions executable by the processor to perform method steps for 
detecting script language viruses, the method steps comprising: 

preparing language description data corresponding to at least one script 
language; preparing detection data for viral code corresponding to a script language 
virus; and lexically analyzing a data stream to identify the at least one script language; 

lexically analyzing the data stream using the language description data to 
generate a stream of tokens; 

generating viral code detection data by analyzing a plurality of samples of 
polymorphic script language viral code: and 

lexically analyzing the stream of tokens using the detection data and the 
language description data to identify the script language virus. 

Claim 16 (Currently Amended) An apparatus for detecting script language 
viruses, comprising: 
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a script language processor, wlierein tlie script language processor prepares 
language description data corresponding to at least one script language; 

a detection data processor, wherein the detection data processor pr e par e d 
prepares detection data for viral code corresponding to a script language virus and 
wherein the detection data processor generates viral code detection data by analyzing a 
plurality of samples of polymorphic script language viral code : and 

a detection engine, wherein the detection engine converts a data stream to a 
stream of tokens using lexical analysis, wherein the tokens correspond to respective 
language constructs, wherein the detection engine lexically analyzes the stream of 
tokens using the language description data and the detection data to identify the script 
language virus. 

Claim 24 (Currently Amended) A method, comprising: 
using a processor for: 
receiving a data stream; 

lexically analyzing the data stream to identify a script language; receiving 
language description data for the script language; 

lexically analyzing the data stream using the language description data to 
generate a stream of tokens; 

generating viral code detection data by analyzing a plurality of samples of 
polymorphic script language viral code; and 
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lexically analyzing the stream of tokens using the viral code detection data and 
the language description data to identify at least one script language virus. 
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Allowable Subject Matter 

4. Claims 1-14, 16-22 and 24 are allowed. 

5. The following is an examiner's statement of reasons for allowance: The prior art 
teaches methods of detecting script language viruses by preparing language description 
data corresponding to at least one script language and preparing detection data for viral 
code corresponding to a script language virus and performing lexical analysis to identify 
a script language and generate a stream of tokens. The prior art also generally teaches 
generating viral code detection data and performing lexical analysis on a stream of 
tokens. However, the prior art does not specifically disclose analyzing a plurality of 
samples of polymorphic script language viral code nor does the prior art teach lexically 
analyzing a stream of tokens to identify at least one script language virus. As such the 
prior art fails to disclose "generating viral code detection data by analyzing a plurality of 
samples of polymorphic script language viral code; and lexically analyzing the stream of 
tokens using the viral code detection data and the language description data to identify 
at least one script language virus" as similarly claimed in each of the independent 
claims when in combination with the remaining claimed limitations. 

Any comments considered necessary by applicant must be submitted no later 
than the payment of the issue fee and, to avoid processing delays, should preferably 
accompany the issue fee. Such submissions should be clearly labeled "Comments on 
Statement of Reasons for Allowance." 
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Conclusion 

Any inquiry concerning tliis comnnunication or earlier comnnunications from tlie 
examiner sliould be directed to MICHAEL PYZOCHA whose telephone number is 
(571)272-3875. The examiner can normally be reached on Monday-Thursday, 7:00am - 
4:30pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Emmanuel Moise can be reached on (571) 272-3865. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 
273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/Michael Pyzocha/ 
Examiner, Art Unit 2437 



